Skip to content
Fencer Vulns
medium 6.1

CVE-2021-30151 json

Cross-site Scripting in Sidekiq

published 2021-04-06 5 y ago modified 2026-06-17 4 mo ago also GHSA-grh7-935j-hg6w , EUVD-2021-2205

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.2%
EPSS 4.2% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known, plus a Nuclei check

Summary

Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.

Patch / fix

  • rubygems sidekiq 5.2.0, 6.2.1
  • ruby-sidekiq Debian 14, Debian 13, Debian 12 6.3.1+dfsg-1

debian advisories DEBIAN-CVE-2021-30151

  • ruby-sidekiq Ubuntu Pro 18.04 LTS 5.0.4+dfsg-2ubuntu0.1~esm1
  • ruby-sidekiq Ubuntu Pro 20.04 LTS 5.2.7+dfsg-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2021-30151

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el7sat
  • foreman satellite utils 6.11, satellite capsule 6.11, satellite 6.11 3.1.1.21-2.el8sat
  • libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el7pc
  • libsolv satellite capsule 6.11, satellite 6.11 0.7.22-1.el8pc
  • candlepin satellite 6.11 4.1.13-1.el7sat
  • candlepin satellite 6.11 4.1.13-1.el8sat
  • satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el7sat
  • satellite satellite utils 6.11, satellite capsule 6.11, satellite 6.11 6.11.0-2.el8sat

red hat advisories RHSA-2022:5498

  • libdb Rocky Linux 8 5.3.28-42.el8_4

rocky linux advisories RLSA-2022:5498

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-30151 updated cvss 5.5

sidekiq: XSS via the queue name of the live-poll feature

  • Red Hat Satellite 6.11 for RHEL 7 tfm-rubygem-sidekiq 5.2.10-1.el7sat
    fixed: vendor fix RHSA-2022:5498
  • Red Hat 3scale API Management Platform 2 sidekiq Red Hat Satellite 6.11 for RHEL 7 tfm 7.0-1.el7sat, gofer 2.12.5-7.el7sat, katello 4.3.0-3.el7sat, libsolv 0.7.22-1.el7pc, libcomps 0.1.18-1.el7pc, libsolv0 0.6.34-4.el7sat, +637 more Red Hat Satellite 6.11 for RHEL 8 libdb 5.3.28-42.el8_4, katello 4.3.0-3.el8sat, libsolv 0.7.22-1.el8pc, libcomps 0.1.18-1.el8pc, python-idna 3.3-1.el8pc, python-pbr 5.6.0-1.el8pc, +629 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.16% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Sidekiq <=6.2.0 - Cross-Site Scripting nuclei detection template
  • github.com https://github.com/mperham/sidekiq/issues/4852 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
rubygems sidekiq
<5.2.0
>=6.0.0, <6.2.1
5.2.0
6.2.1

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.